# `delegated[]` state is not removed after it reaches zero, potentially leading to higher computational costs and DoS

Aleo's credits.aleo never deletes zeroed delegated[] entries, letting anyone bond/unbond to arbitrary addresses and permanently bloat a mapping iterated on every transaction.

- Payout: Contest reward
- Severity: medium
- Program: Aleo
- Credited: sammy
- Disclosed: 2024-05-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-aleo-judging/issues/25
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-aleo%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:rust technique:source-review vuln:business-logic vuln:dos

**Target:** credits.aleo delegated[] mapping / committee reward computation
**Root cause:** remove_validator decrements delegated[validator] to zero but never removes the key, so zero-value entries persist in storage forever. The delegated map is iterated on every transaction to compute staking rewards, so unbounded growth raises per-tx cost.
**Steps:**
1. Attacker holds >=10,000 credits (MIN_DELEGATOR_STAKE).
2. Call `bond_public` delegating to an arbitrary address (need not be a real committee member).
3. Call `unbond_public` then `claim_unbond_public` to recover the stake.
4. Repeat across many distinct addresses; each leaves a permanent zero-value `delegated[address]` entry.
5. PoC test `test_bond_delegator_to_multiple_random_validators` loops 1000 bond/unbond/claim cycles against random validators.
6. Every subsequent network transaction iterates the enlarged delegated_map in committee.rs, increasing cost.
**How found:** Code review of remove_validator noticed delegated[] is decremented but not removed, unlike bonded[] which is explicitly removed. Traced the mapping to committee.rs where it is fully iterated, then wrote a test proving permissionless bond/unbond to arbitrary addresses.
**Exploitation:** Attacker pays only gas fees per bond/unbond cycle (credits are reusable), permissionlessly creating unlimited delegated[] keys. Since the mapping is iterated in every transaction network-wide and entries cannot be removed, storage and computation costs grow permanently, degrading or DoSing the chain.
**Escalation:** Impact scales with number of distinct addresses targeted; affects all transactions, not just credits.aleo, and is irreversible without a network reset.
**Insight:** On L1/chain-level code, check whether every mapping that is fully iterated per-transaction has a deletion path when its value hits zero; a decrement-to-zero without `remove` is a permanent storage-growth vector even when each entry is worthless.